A high-severity use-after-free vulnerability in the Envoy proxy can lead to service denial via process crashes when the optional oghttp2 codec is enabled.

This flaw stems from improper input validation in the oghttp2 upstream HTTP/2 codec, specifically regarding the handling of HEADERS frames lacking the END_STREAM flag. An unauthenticated attacker can exploit this to create a dangling reference, eventually causing a use-after-free condition that crashes the Envoy process.

The successful exploitation of this vulnerability results in a denial of service for the affected proxy, which may disrupt traffic for all downstream services relying on that instance. Given the CVSS score of 7.5, this is a significant risk for high-availability environments where Envoy acts as a critical edge or service mesh component. System downtime caused by repeated crashes could lead to severe operational impact and degraded user experience.

Immediate Action: Update Envoy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 to incorporate the necessary security patches.

Proactive Monitoring: Monitor Envoy process logs and metrics for frequent restarts or crash reports, which may indicate active attempts to exploit this vulnerability.

Compensating Controls: If immediate patching is not feasible, disable the optional oghttp2 codec if your infrastructure allows, or ensure that traffic is routed through the default nghttp2 codec which is not affected by this flaw.

Public Exploit Available: No

Organizations utilizing Envoy in a cloud-native architecture must prioritize this update, especially if they have enabled the oghttp2 codec for their upstream configurations. The ability for an unauthenticated remote attacker to trigger a crash poses a direct threat to service availability, and applying the vendor-provided patches is the only definitive way to resolve the underlying memory management defect.